Channel 4 has a bring your own device (BYOD) scheme in place but is yet to find a mobile device management (MDM) solution that "truly works", according to its CISO, Brian Brackenborough.
In an interview with Computing, Brackenborough explained that when he first joined Channel 4 as CISO in September 2011, he was surprised to see how many personal devices were already being used in the workplace.
Further reading
The CISO perspective: The pros and cons of BYOD iPhones are about 'fashion rather than functionality', says DWF CTO CISOs: Big security vendors caught on the hop by rise in enterprise mobility
"At one point I wanted to say we won't allow personal devices and that we as a company would supply all of the corporate iPhones if people needed email," he said. "It's not actually that costly for a company of this size considering its turnover, but when I saw that 75 per cent of all the devices being used were personally owned, I realised that there is something we had to do about it."
The organisation insists that employees who want to use corporate email need to have their devices encrypted and enable Channel 4 to be able to remote wipe and remotely locate devices that are lost or stolen.
Channel 4 operates a Citrix VM environment, and if an employee wanted to install the Citrix client onto their iPad or iPhone to access any particular business applications, the organisation will allow them to do so, but Brackenborough said that this was not the main focus for the Citrix deployment as it was meant for remote working.
He said that email was the main corporate use of a mobile device, and therefore an MDM solution is important. It currently uses ActiveSync.
"ActiveSync is for device wiping," he said. "We are happy enough with it at the moment but I see it as an area where we could be stronger."
But Brackenborough has not yet been able to find the right MDM solution for Channel 4.
"I want an MDM solution that focuses on the idea of selective wiping," he said. "My concern has always been with regards to the legislation around what happens if you remotely wipe somebody else's device and you lose their photos and personal things – not when the device is lost or stolen but if the employee has left the company under a cloud. What situation are you putting the company in? Can you rely on the fact that you've got them to sign a piece of paper which says they are happy for us to remote wipe their device?
"What we are trying to focus on is having a selective wipe process on an MDM solution and I haven't found one that I think truly works yet, but it is something we will be looking for at Infosec Europe next week," he said.
Brackenborough said that Channel 4 had looked at some of the main players in the MDM market but that many of these solutions did not fulfil the organisation's requirements.
However, he admitted that Channel 4 would need to look into the products in more depth before making a final decision. This will start with Microsoft's Intune mobile device management solution, which will be trialed across the organisation.
